Table "process_file_events" returns nothing
Hi everybody, I'm currently doing a thesis at uni about system administration, and my professor wants me to study and use osquery for socket and process auditing and for file integrity monitoring.
For the FIM part, I wanted to use the the "process_file_events" table because I think it contains the most useful informations. I am running osquery on Debian 12, and to start it I use the following line with superuser privileges:
osqueryi\
--verbose\
--audit_allow_fim_events=true\...